Read the docs
TI-2025-01809 Aliases CVE-2025-2071GHSA-v4xx-gfq7-pcp4

OS Command Injection Vulnerability in FAST LTA Silent Brick WebUI

Priority MEDIUM 51CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed directly to system-level commands without adequate sanitization or validation. Successful exploitation could allow attackers to execute arbitrary commands on the affected system, potentially resulting in unauthorized access, data leakage, or full system compromise. Affected WebUI parameters are "hd" and "pi".

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00994 62nd percentileScored 2026-11-07
Fix Fixed FAST LTA Silent Brick WebUI (FAST LTA): 2.63.04

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FAST LTAFAST LTA Silent Brick WebUIWebUI Release 2.45 (Linux 5.4.109-gentoo-FAST) to before 2.63.042.63.04Patch availableCNA
  • FAST LTA Silent Brick WebUI VendorFAST LTA Affected WebUI Release 2.45 (Linux 5.4.109-gentoo-FAST) to before 2.63.04 Fixed in 2.63.04 Patch available CNA

Remediation

  • Fix · CNA FAST LTA Silent Brick WebUI (FAST LTA) Fixed in 2.63.04

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FAST LTA Silent Brick WebUI 2.63.04

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-01810 Reflected Cross-Site Scripting (XSS) Vulnerability in FAST LTA Silent Brick WebUIPriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-2071
  2. 2026-10-03 Alias added: GHSA-v4xx-gfq7-pcp4

References

Other 1

  • TI-2025-01810 Reflected Cross-Site Scripting (XSS) Vulnerability in FAST LTA Silent Brick WebUI CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences